CVE-2026-109667: Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 15.111.0 - Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.22.0
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.111.0 are affected, as are 16.x versions before 16.22.0.
What access does an attacker need to exploit this issue?
An attacker needs an authenticated ERPNext account. The account does not need an operational role, and no user interaction is required.
What is the likely impact of successful exploitation?
An authenticated attacker can create privileged accounts by supplying a privileged record type to the vulnerable record-creation endpoint. This can allow the attacker to take full control of the site.